Executive brief
Webpack 5 is a build tool used by developers to bundle JavaScript applications. A vulnerability in how Webpack processes magic comments could allow an attacker to bypass security boundaries and access the global JavaScript object, potentially leading to unauthorized code execution or data theft during the build process.
Technical details
Webpack 5 before version 5.76.0 improperly handles cross-realm object access in the ImportParserPlugin.js component, specifically in the magic comment feature processing. The vulnerability allows an attacker who controls an untrusted object property to gain access to the real global object, breaking JavaScript realm isolation. This is a sandbox escape that occurs at build time. The attack requires the ability to influence build inputs but does not require authentication or user interaction. The fix was implemented in Webpack 5.76.0 and later versions.
Affected products
- webpack webpack 5.0.0 before 5.76.0
Timeline
- 2023-03-13: disclosed
- 2023-03-13: patched: Fixed in version 5.76.0